On this page
Ask most vendors whether they’re SOC 2 compliant, and a confident “yes” comes back within a sentence. Then ask a follow-up. When was the audit? Who was the auditor? Was it a Type I snapshot or a Type II window? The confidence tends to thin out fast. We’d rather tell you where we stand.
Where we stand
Beemy is at the readiness stage for SOC 2 Type II. We are not certified, and no one has audited us. In plain terms, we have not engaged an auditor yet, and no observation window has opened. The controls that SOC 2 checks already run in our system. We still won’t round that up to “compliant.”
Why running controls isn’t the same as certification
This distinction is easy to blur, so we’ll keep it sharp. For us, SOC 2 Type II is mostly about naming and evidencing controls the architecture already enforces. We don’t have to build new safeguards from scratch. These are the silo isolation, encryption and deletion guarantees on our Trust page. The audit describes them in the language an auditor checks against. It then proves that they hold over a sustained period.
That’s why the difference matters. Type II measures a window, where a Type I report captures a single moment. An auditor doesn’t take our word for it once. They watch the controls hold over several months. We haven’t started that clock. Until we do, “readiness” is the honest word. We won’t reach for “certified” early because it looks better on a page.
What’s running today
None of this is a promise to build the controls later. The list is concrete, and every item on it is live:
- Silo isolation: personal, work and public knowledge sit in physically separate stores. There’s no shared database with a flag on each row.
- Envelope encryption and a KMS key hierarchy: each tenant has its own keys. No single shared secret protects everyone.
- An immutable, hash-chained audit log: the log is append-only, and nothing in it can be rewritten afterwards.
- Crypto-shred deletion: deleting an account destroys its keys, which goes further than deleting a row.
- No-train model routing: your content never trains a shared model, and the routing layer enforces that.
- TLS 1.3: it protects data everywhere it moves.
- An always-on security CI gate: every change ships through automated checks, with no wait for a quarterly review.
Every item on that list runs in production today, whether or not an auditor has looked at it. We’re confident about that part. The audit itself is what’s left: we still have to engage an auditor and complete the observation window that Type II requires.
What we won’t say until it’s true
We won’t write “SOC 2 Type II certified” on this site until an auditor has watched the window close. We won’t say “audited” before an audit has happened. And we won’t soften “readiness stage” into a phrase that sounds more finished. When the window closes and we hold the report, we’ll say so. We won’t say it a day before.
Are you evaluating Beemy for your team? You’ll want the specifics: what’s covered, what the timeline looks like, and what your compliance team will ask to see. Our enterprise conversation exists for exactly that. Talk to us.